diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cc4671189..97dbbf828 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -126,7 +126,7 @@ jobs:
         token: ${{ steps.generate_token.outputs.token }}
 
     - name: Setup Syft
-      uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
+      uses: anchore/sbom-action/download-syft@a930d0ac434e3182448fe678398ba5713717112a # v0.21.0
 
     - name: Setup Cosign
       uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
diff --git a/.github/workflows/verify-md.yml b/.github/workflows/verify-md.yml
index 5d8f64543..c768a8144 100644
--- a/.github/workflows/verify-md.yml
+++ b/.github/workflows/verify-md.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Spellcheck
-        uses: rojopolis/spellcheck-github-actions@16d0338a5a3b5e3111a078029fb9a07a8125053d # 0.55.0
+        uses: rojopolis/spellcheck-github-actions@cebe06444da3ac5e9d3146f5f02a0e2a236f7488 # 0.56.0
         with:
           config_path: .github/config/spellcheck.yml
           task_name: Markdown